Supreme Court Limits Reach of Federal Law on Computer Crime

WASHINGTON — The Supreme Court on Thursday narrowed the scope of a federal law that makes it a crime to gain access to computer files without authorization. By a 6-to-3 vote, the court sided with a former police officer in Georgia who used his position to search digital license-plate records for an illicit purpose.

Justice Amy Coney Barrett wrote the majority opinion, which featured an unusual coalition made up of the other two justices appointed by President Donald J. Trump and the court’s three-member liberal wing.

The officer, Nathan Van Buren, agreed to search the license-plate records in exchange for a $5,000 payment from a man who turned out to be an F.B.I. informant. Though Mr. Van Buren’s job gave him access to the database, his search on that occasion violated department policy because it was not done in connection with his duties.

Mr. Van Buren was charged with violating the Computer Fraud and Abuse Act of 1986, a federal law that makes it illegal “to access a computer with authorization and to use such access to obtain or alter information in the computer that the accesser is not entitled so to obtain or alter.”

He was convicted and sentenced to 18 months in prison. Justice Barrett, writing for the majority, said Mr. Van Buren’s conduct was not a crime under the 1986 law.

“This provision covers those who obtain information from particular areas in the computer — such as files, folders or databases — to which their computer access does not extend,” she wrote. “It does not cover those who, like Van Buren, have improper motives for obtaining information that is otherwise available to them.”

Justices Stephen G. Breyer, Sonia Sotomayor, Elena Kagan, Neil M. Gorsuch and Brett M. Kavanaugh joined Justice Barrett’s majority opinion.

Most of Justice Barrett’s opinion was devoted to parsing the statutory text. But she also cautioned that a contrary ruling would have made everyday conduct criminal.

“The government’s interpretation of the statute would attach criminal penalties to a breathtaking amount of commonplace computer activity,” she wrote. “If the ‘exceeds authorized access’ clause criminalizes every violation of a computer-use policy, then millions of otherwise law-abiding citizens are criminals.”

“Take the workplace,” Justice Barrett wrote. “Employers commonly state that computers and electronic devices can be used only for business purposes. So on the government’s reading of the statute, an employee who sends a personal email or reads the news using her work computer has violated” the 1986 law.

Citing friend-of-the-court briefs, including one filed by The New York Times Company and other news organizations, Justice Barrett wrote that the government’s approach might “criminalize everything from embellishing an online dating profile to using a pseudonym on Facebook.”

In dissent, Justice Clarence Thomas responded that “much of the federal code criminalizes common activity” and that most violations of the 1986 law would be charged as misdemeanors if they were pursued at all.

“The number of federal laws and regulations that trigger criminal penalties may be as high as several hundred thousand,” he wrote, citing ones punishing the removal of a grain of sand from the National Mall, breaking a lamp in a government building or letting a horse eat grass on federal land.

“It is understandable to be uncomfortable with so much conduct being criminalized,” Justice Thomas wrote, “but that discomfort does not give us authority to alter statutes.”

Chief Justice John G. Roberts Jr. and Justice Samuel A. Alito Jr. joined Justice Thomas’s dissent in the case, Van Buren v. United States, No. 19-783.

Justice Thomas wrote that laws routinely punish people entitled to use property for one purpose when they use it for another.

“A valet, for example, may take possession of a person’s car to park it, but he cannot take it for a joy ride,” he wrote. “An employee who is entitled to pull the alarm in the event of a fire is not entitled to pull it for some other purpose, such as to delay a meeting for which he is unprepared.”

“And, to take an example closer to this statute, an employee of a car rental company may be ‘entitled’ to ‘access a computer’ showing the GPS location history of a rental car and ‘use such access’ to locate the car if it is reported stolen,” Justice Thomas wrote. “But it would be unnatural to say he is ‘entitled’ to ‘use such access’ to stalk his ex-girlfriend.”